Why does the NVD find nothing for MCUboot?
On 27 October 2026 the NVD's CPE dictionary has no entry for MCUboot. Queries with the obvious vendor names (mcu-tools, linaro, trustedfirmware, arm and others) return 0 for every version. A keyword search for „mcuboot“ finds four CVEs, none with a configuration; two of them do not concern MCUboot at all, but TF-M and a Zephyr driver.
Checking MCUboot only against the NVD therefore shows a zero that means nothing. The sources are the security advisories in the mcu-tools/mcuboot repository and the CVE records themselves.
curl -s "https://services.nvd.nist.gov/rest/json/cpes/2.0?keywordSearch=mcuboot" \
| jq .totalResults0Which vulnerabilities does MCUboot itself have?
| Identifier, CVSS | What, affected versions |
|---|---|
| GHSA-gcxh-546h-phg4, 9.6 | Hard-coded sample keys. Up to 1.7.0; 1.8.0 lists the fix under „Security fixes“. The CVE identifier it names has no published record. |
| CVE-2024-32883, 7.7 | Unprotected TLV entries in the image can be injected. GitHub says „before 1.11.0“; the fix only came with 2.1.0, so 2.0.0 is affected too. |
| CVE-2026-14296, 7.5 | Direct XIP on the nRF54H20: MCUboot can start unverified code under some conditions. Nordic names nRF Connect SDK 3.2.1 to 3.2.4 (advisory SA-2026-521). |
| GHSA-8hrv-4cp5-4rg3, 4.8 | Integer underflow when reading TLV data, physical access. From 1.7.0 to before 1.10. |
Which MCUboot version do Zephyr and the nRF Connect SDK ship?
Zephyr pins MCUboot in west.yml. Only Zephyr 4.4.2 pins exactly a release; the other states lie between two releases. The nRF Connect SDK takes MCUboot from Nordic's own repository sdk-mcuboot, which picks fixes one by one; the shared state with upstream is only a lower bound there.
| SDK, release | MCUboot inside, fix for CVE-2024-32883 |
|---|---|
| Zephyr 4.4.2, 7 Aug 2026 | 2.4.0; contained |
| Zephyr 3.7.2 (LTS), 31 Mar 2026 | state after 2.1.0; contained |
| Zephyr 2.7.6 (LTS), 1 Mar 2024 | state after 1.7.0, before 1.8.0; missing, as are the fixes of 1.8.0 and 1.10.0 |
| nRF Connect SDK 3.4.1, 17 Sep 2026 | at least the state after 2.2.0, the VERSION file says 2.3.0-dev; contained |
Which MCUboot lines are maintained?
MCUboot has no LTS line and no patch release since 1.7.2 from 16 March 2021. A fix ships with the next version. The newest is 2.5.0, tagged on 22 October 2026; on 27 October 2026 the GitHub release page still shows 2.4.0 from 23 April 2026.
Careful with the file boot/zephyr/VERSION: at 2.1.0 and 2.2.0 it reads 2.1.0-dev. A version taken from that file can lag the real release.
Where is the MCUboot version in the image?
From 2.1.0 on, MCUboot under Zephyr prints its own banner at boot, such as „*** Booting MCUboot v2.4.0 ***“; the Espressif port writes „*** Booting MCUboot build …“. The banner can be switched off.
Do not confuse it: the field ih_ver in the image header is the version of the application signed with imgtool sign --version, not MCUboot's.
curl -s https:/Output
22: printk("*** Booting MCUboot " APPLICATION_BANNER_VERSION " ***\n");How do I check this by hand?
- 1
Read the version:
strings -a mcuboot.bin | grep "Booting MCUboot", in the project fromwest.ymlandgit describein the MCUboot directory. - 2
Do not ask the NVD, but the advisories in
mcu-tools/mcubootand, for the nRF Connect SDK, Nordic's advisories. - 3
Check whether the fix for CVE-2024-32883 is in your state (commit „boot: Enforce TLV entries to be protected“).
- 4
Check whether the sample keys from the repository are still in use.
- 5
Check the CISA KEV catalogue for actively exploited vulnerabilities.
Can this run automatically?
LegacyMind reads the RTOS and the linked libraries with their versions from the build and checks each against the vulnerability sources, including advisories without an NVD configuration, with the place in the build where it was found. If the binary proves no version, the field stays empty.
Questions
Does MCUboot have no CVEs because the NVD finds none?
No. The NVD has no CPE for MCUboot, so every version query returns 0. Four vulnerabilities in MCUboot itself are public, one of them at CVSS 9.6.
Is MCUboot 2.0.0 affected by CVE-2024-32883?
Yes. GitHub says „before 1.11.0“, but the fix is only in 2.1.0; 2.0.0 does not contain it.
Is an MCUboot vulnerability actively exploited?
As of 27 October 2026 no MCUboot vulnerability is in the CISA catalogue of known exploited vulnerabilities (catalogue version 2026.10.26).
Which version is in the image header?
The header field ih_ver is the version of the signed application. MCUboot's own version is in the banner or the build project.